SecOps-Architect Secops Frameworks And Threat Response Architecture Practice Test 6 — 15 Questions

Question 1

A security architect is mapping the SOC's detection and response capabilities to the MITRE ATT&CK framework. The CISO wants to know which adversary tactic is most directly addressed by correlating endpoint process creation events with network connection events in Cortex XDR. Which ATT&CK tactic does this correlation primarily support?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Command and Control. Pairing process creation with network connection events exposes which executables are generating outbound traffic, the defining signal of Command and Control. Cortex XDR's causality chain links the initiating process to its remote destinations, enabling detection of beaconing and unauthorized egress. The other tactics either occur earlier in the kill chain or rely on different telemetry, so Command and Control is the correct mapping.

Answer

Initial Access

Answer

Persistence

Answer

Privilege Escalation

Question 2

A security operations architect is designing a threat intelligence-driven response architecture using Cortex XSOAR. The architect wants to automatically enrich indicators of compromise (IOCs) from multiple sources and then make a risk-based decision to block or allow them. Which component of Cortex XSOAR should be used to define the logic that correlates and scores the IOCs from different intelligence sources?

Accepted Answer

Reputation Calculation. Reputation Calculation is the Cortex XSOAR feature that enables architects to define custom scoring logic for indicators, aggregating data from multiple sources and applying weights to produce a risk score. This score can then drive automated decisions. The other options are structural or connectivity components that do not provide the required correlation and scoring logic.

Answer

Indicator Type

Answer

Playbook

Answer

Integration Instance

Question 3

A multinational corporation is architecting a Security Operations Center (SOC) using the MITRE ATT&CK framework to prioritize detection engineering efforts. The SOC has limited resources and wants to focus on techniques that are most relevant to its industry and threat landscape. The architect must recommend a systematic approach to map existing detection rules to ATT&CK techniques and identify gaps. Which activity best accomplishes this?

Accepted Answer

Perform a detection coverage assessment using ATT&CK Navigator to visualize mapped techniques and identify unmitigated areas.. Using ATT&CK Navigator to map existing detection rules and visualize coverage is the most systematic and repeatable way to identify gaps. It allows the SOC to prioritize techniques relevant to their industry and allocate resources effectively, directly addressing the need to focus limited resources on the most pertinent threats.

Answer

Conduct a red team exercise and map observed techniques to ATT&CK.

Answer

Subscribe to a commercial threat intelligence feed and automatically ingest all indicators into the SIEM.

Answer

Implement a honeypot network and analyze attacker behavior to derive detection rules.

Question 4

An architect is aligning a new SOC's response workflow with the NIST SP 800-61 incident handling lifecycle. During the containment, eradication, and recovery phase, the team must decide which activities belong there rather than in later lessons-learned work. Which two activities are correctly performed within that phase? (Choose two.)

Accepted Answer

Rebuilding an affected host from a known-good image after removing the threat. NIST SP 800-61 places containment, eradication, and recovery actions such as isolating hosts and rebuilding systems in the third phase. Post-mortems, policy revisions, and notifications are either post-incident activities or separate governance obligations. Keeping the phase boundaries clear prevents premature closure and preserves evidence integrity during active handling.

Answer

Publishing a public breach notification to regulators before containment completes

Answer

Conducting a post-mortem meeting to update detection rules and response procedures

Answer

Approving the incident response policy revision in the change advisory board

Question 5

A SOC architect is defining the containment step in the incident response lifecycle for ransomware affecting a single endpoint. The endpoint is managed by Cortex XDR and is still communicating with its command-and-control server. Which action best satisfies immediate containment while preserving forensic evidence?

Accepted Answer

Isolate the endpoint using the Cortex XDR network isolation capability, which blocks all network traffic except the management channel.. Network isolation through Cortex XDR cuts off the C2 channel while preserving the agent's management path, allowing remote forensic collection and analyst control. Reimaging, powering off, and deleting files either destroy evidence or fail to stop live adversary communication. Isolation is the standard containment action that balances stopping the threat with retaining investigative data.

Answer

Delete the malicious files identified by the Cortex XDR alert and continue monitoring the endpoint.

Answer

Power off the endpoint to stop encryption and prevent further C2 communication.

Answer

Immediately reimage the endpoint to remove the ransomware and restore it to a known-good state.

Question 6

A security architect is designing a detection and response strategy using Cortex XSIAM. The architect needs to ensure that the platform can automatically correlate alerts from multiple sources and prioritize them based on severity. Which Cortex XSIAM capability should the architect leverage to achieve this?

Accepted Answer

Analytics. Cortex XSIAM Analytics is designed to automatically correlate alerts from disparate sources and apply risk-based prioritization. It uses advanced analytics to group related alerts into incidents and assign severity, enabling efficient triage. The other options are supporting components that do not provide the required correlation and prioritization.

Answer

Playbooks

Answer

Data Model

Answer

Threat Intelligence Management

Question 7

An architect is defining severity scoring for a SOC that consumes vulnerability data from multiple scanners. Leadership wants scores that reflect exploitability in the wild rather than only theoretical severity. Which framework should the architect adopt as the primary prioritization input for this requirement?

Accepted Answer

Exploit Prediction Scoring System (EPSS) combined with CISA's Known Exploited Vulnerabilities catalog. EPSS provides a forward-looking probability of exploitation, while the CISA KEV catalog confirms exploitation has already occurred. Combining them prioritizes vulnerabilities that matter in the wild, which is the stated requirement. CVSS base scores, OWASP categories, and CWE frequencies describe severity, risk classes, or weakness types rather than real-world exploitation likelihood.

Answer

Common Vulnerability Scoring System (CVSS) base score alone

Answer

Common Weakness Enumeration (CWE) identifier frequency across the environment

Answer

Open Web Application Security Project (OWASP) Top 10 category ranking

Question 8

A SOC architect is designing a threat response architecture that uses Cortex XSIAM to automate response actions across endpoint, network, and cloud domains. The CISO requires that automated actions be auditable and reversible where possible. Which TWO design elements are essential to meet these requirements? (Choose two.)

Accepted Answer

Define rollback or compensating actions for each automated response, such as releasing an endpoint from isolation or restoring a quarantined file.. Auditability demands a centralized, tamper-resistant record of every action's initiator, target, and outcome, while reversibility demands a defined compensating action for each automated response. Together these two elements let the SOC verify and undo automated actions. Excessive privileges, blanket manual approval, and local-only logging either weaken security or fail the stated requirements.

Answer

Store all response action logs only on the local endpoint to reduce central storage costs and latency.

Answer

Disable automated response entirely and require a human analyst to approve every action manually.

Answer

Grant the automation engine domain administrator rights so it can perform any response action without encountering permission errors.

Question 9

A SecOps architect is designing an automated containment workflow in Cortex XSOAR that must isolate a compromised endpoint, block the attacker's IP at the perimeter firewall, and open a ticket in the ITSM system. The containment playbook must execute these actions in parallel with a strict 15-minute SLA, and each action must produce an independent audit trail for post-incident review. Which Cortex XSOAR feature should the architect use to meet these requirements?

Accepted Answer

Playbook tasks configured as 'parallel' tasks that fork independent execution branches. Parallel tasks in Cortex XSOAR fork a playbook into concurrent branches, which is the native mechanism for executing containment actions simultaneously. Because each branch records its own task results in the war room, the architecture satisfies both the 15-minute SLA and the requirement for independent, reviewable audit trails without splitting the investigation into multiple incidents.

Answer

Three separate playbooks triggered by an indicator-based incident type classifier

Answer

A single script task using the Demisto REST API to invoke all three integrations

Answer

Playbook tasks configured as 'section headers' with dependent branching

Question 10

A security architect is designing a ransomware containment playbook in Cortex XSOAR. The playbook must automatically isolate an infected endpoint, extract its forensic artifacts, and then restore it to the production network only after a senior analyst approves. Which Cortex XSOAR task type best enforces the manual approval step before the restoration task executes?

Accepted Answer

A manual task assigned to the senior analyst's role. The requirement is a human decision point that blocks further automation until a senior analyst signs off. In Cortex XSOAR, a manual task creates exactly that pause and can be assigned to a role for accountability. Conditional, data collection, and notification tasks all serve different purposes and none of them enforces a mandatory approval before the restoration task executes.

Answer

A data collection task that gathers analyst input

Answer

A built-in script task that sends an email notification

Answer

A conditional task that checks the endpoint status

Question 11

A security operations architect is designing a threat response architecture that integrates Cortex XSOAR with various security tools. The architect must ensure that the playbooks can automatically gather enriched context from external sources and make informed decisions. Which TWO components are essential for enabling automated enrichment and decision-making in Cortex XSOAR playbooks? (Choose two.)

Accepted Answer

Integrations. Integrations provide the external connectivity and commands needed to enrich data, while Playbook Tasks define the logic and sequence of actions that use that data to make decisions. Together, they enable automated enrichment and decision-making in Cortex XSOAR playbooks. The other components support organization and visualization but are not directly involved in the automation logic.

Answer

Dashboards

Answer

Indicator Types

Answer

Incident Types

Question 12

A SOC architect at a healthcare provider is mapping detection coverage to the MITRE ATT&CK framework using Cortex XSIAM. The CISO wants a heat map that shows which adversary techniques are covered by existing analytics and which are blind spots, using the native ATT&CK coverage view. Which prerequisite must the architect satisfy for techniques to be correctly attributed in that view?

Accepted Answer

Each analytics rule must be tagged with the corresponding ATT&CK technique IDs. The ATT&CK coverage heat map in Cortex XSIAM is generated from technique metadata attached to detection content. Tagging each analytics rule with the specific MITRE technique IDs it detects is what lets the platform attribute coverage and reveal blind spots. Other telemetry or licensing actions do not affect how techniques are mapped in the native view.

Answer

Every detection rule must be converted into a correlation rule with a severity threshold

Answer

The healthcare organization must subscribe to a commercial ATT&CK intelligence feed

Answer

All endpoints must forward full packet capture to the XSIAM broker

Question 13

A security architect is designing a threat response architecture that must coordinate actions across Cortex XSIAM, Cortex XSOAR, and third-party firewalls. During a recent exercise, response actions executed in the wrong order, causing an endpoint to be isolated before its indicators were enriched, which delayed the firewall block. The architect must ensure deterministic ordering of enrichment and containment steps. Which design approach best addresses this?

Accepted Answer

Model the response as a Cortex XSOAR playbook with explicit task dependencies and conditional branches that enforce enrichment before containment.. Deterministic ordering requires an orchestration layer that models task dependencies, and Cortex XSOAR playbooks provide exactly that through sequential tasks and conditional branches. Enrichment can be made a prerequisite for containment, ensuring indicators are available before isolation or firewall blocks execute. Polling changes, parallel execution, and independent listeners either ignore ordering or make it worse.

Answer

Use separate webhook listeners for each system so that each integration receives its commands independently of the others.

Answer

Increase the polling interval on the firewall integration so that block requests are queued and processed in the order they arrive.

Answer

Configure all response actions to run in parallel to reduce mean time to respond and rely on analysts to correct any ordering issues.

Question 14

A security architect is designing a threat intelligence ingestion pipeline for a Cortex XSOAR deployment. The SOC receives feeds from multiple providers, but analysts complain about duplicate indicators and conflicting verdicts. The architect needs to ensure that indicators are automatically deduplicated, scored, and enriched before being used in playbooks. Which Cortex XSOAR feature should be implemented to achieve this?

Accepted Answer

Indicator reputation and deduplication settings. The requirement is to automatically deduplicate, score, and enrich indicators from multiple feeds to avoid duplicates and conflicting verdicts. Cortex XSOAR's indicator reputation and deduplication settings are designed exactly for this purpose, providing centralized management of indicator lifecycle. Other features like extraction rules or playbook branching do not provide automatic deduplication and scoring at the indicator level, making them insufficient for this scenario.

Answer

Indicator extraction and enrichment rules

Answer

Playbook task conditional branching

Answer

Incident type classification rules

Question 15

A security operations architect is designing a SOC that follows the NIST Cybersecurity Framework. The architect needs to ensure that the SOC can effectively respond to incidents. According to the NIST Cybersecurity Framework, which function encompasses the activities to take action regarding a detected cybersecurity incident?

Accepted Answer

Respond. The NIST Cybersecurity Framework's Respond function encompasses the activities necessary to take action after an incident is detected, including containment, eradication, and recovery. The other functions focus on understanding risks, implementing safeguards, or detecting events, but not on the response actions themselves.

Answer

Identify

Answer

Protect

Answer

Detect